VEX records
Browse vendor VEX statements available in this Vulnerability-Lookup instance and pivot to the related vulnerability.
297763 VEX records
API response| Vulnerability | Source | Title | Product status | Imported | Links |
|---|---|---|---|---|---|
| CVE-2026-41389 | redhat_vex | OpenClaw 2026.4.7 < 2026.4.15 - Arbitrary File Read via Unvalidated Tool-Result Media Paths | known not affected: 1 | 2026-06-05T19:36:48+00:00 | Vulnerability · Source |
| CVE-2026-41310 | redhat_vex | OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth | known not affected: 1 | 2026-06-05T19:36:48+00:00 | Vulnerability · Source |
| CVE-2026-41130 | redhat_vex | Craft CMS has a host header injection leading to SSRF via resource-js endpoint | known not affected: 1 | 2026-06-05T19:36:47+00:00 | Vulnerability · Source |
| CVE-2026-41671 | redhat_vex | Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation | known not affected: 1 | 2026-06-05T19:36:47+00:00 | Vulnerability · Source |
| CVE-2026-41965 | redhat_vex | CVE-2026-41965 | known not affected: 1 | 2026-06-05T19:36:47+00:00 | Vulnerability · Source |
| CVE-2026-41929 | redhat_vex | Vvveb < 1.0.8.2 Unauthenticated Reflected XSS via Visual Editor | known not affected: 1 | 2026-06-05T19:36:47+00:00 | Vulnerability · Source |
| CVE-2026-41569 | redhat_vex | authentik: WS-Federation wreply origin bypass can exfiltrate signed login responses to attacker-controlled endpoints | known not affected: 1 | 2026-06-05T19:36:46+00:00 | Vulnerability · Source |
| CVE-2026-41301 | redhat_vex | OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass | known not affected: 1 | 2026-06-05T19:36:45+00:00 | Vulnerability · Source |
| CVE-2026-41374 | redhat_vex | OpenClaw < 2026.3.31 - Resource Consumption via Discord Audio Preflight Before Member Authorization | known not affected: 1 | 2026-06-05T19:36:44+00:00 | Vulnerability · Source |
| CVE-2026-41932 | redhat_vex | Vvveb < 1.0.8.3 Stored XSS via Signup Controller | known not affected: 1 | 2026-06-05T19:36:43+00:00 | Vulnerability · Source |
| CVE-2026-41338 | redhat_vex | OpenClaw < 2026.3.31 - Time-of-Check-Time-of-Use (TOCTOU) Vulnerability in Sandbox File Operations | known not affected: 1 | 2026-06-05T19:36:43+00:00 | Vulnerability · Source |
| CVE-2026-41572 | redhat_vex | Note Mark: Unauthenticated read of notes and assets in soft-deleted public books | known not affected: 1 | 2026-06-05T19:36:43+00:00 | Vulnerability · Source |
| CVE-2026-41365 | redhat_vex | OpenClaw < 2026.3.31 - Sender Allowlist Bypass via Graph API Thread History | known not affected: 1 | 2026-06-05T19:36:41+00:00 | Vulnerability · Source |
| CVE-2026-41392 | redhat_vex | OpenClaw < 2026.3.31 - Exec Allowlist Bypass via Shell Init-File Options | known not affected: 1 | 2026-06-05T19:36:41+00:00 | Vulnerability · Source |
| CVE-2026-41185 | redhat_vex | ServiceAccount token disclosure via Azure IPAM CNI plugin logs | known not affected: 1 | 2026-06-05T19:36:40+00:00 | Vulnerability · Source |
| CVE-2026-41509 | redhat_vex | Integer underflow in crypto_sign_open() leads to buffer overflow | known not affected: 1 | 2026-06-05T19:36:40+00:00 | Vulnerability · Source |
| CVE-2026-41662 | redhat_vex | Admidio: Missing Minimum Administrator Check in Role Membership Removal | known not affected: 1 | 2026-06-05T19:36:40+00:00 | Vulnerability · Source |
| CVE-2026-41051 | redhat_vex | csync2 uses insecure temporary directories when compiled with C99 or later | known not affected: 1 | 2026-06-05T19:36:39+00:00 | Vulnerability · Source |
| CVE-2026-41213 | redhat_vex | @node-oauth/oauth2-server: PKCE code_verifier ABNF not enforced in token exchange allows brute-force redemption of intercepted authorization codes | known not affected: 1 | 2026-06-05T19:36:39+00:00 | Vulnerability · Source |
| CVE-2026-41967 | redhat_vex | CVE-2026-41967 | known not affected: 1 | 2026-06-05T19:36:38+00:00 | Vulnerability · Source |
| CVE-2026-41499 | redhat_vex | Wazuh: Multiple Heap-based NULL WRITE Buffer Underflows in parse_uname_string() | known not affected: 1 | 2026-06-05T19:36:38+00:00 | Vulnerability · Source |
| CVE-2026-41136 | redhat_vex | free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer | known not affected: 1 | 2026-06-05T19:36:37+00:00 | Vulnerability · Source |
| CVE-2026-41141 | redhat_vex | EspoCRM: IDOR in EmailTemplate Prepare Endpoint Leaks Entity Data via Email Address Lookup | known not affected: 1 | 2026-06-05T19:36:37+00:00 | Vulnerability · Source |
| CVE-2026-41361 | redhat_vex | OpenClaw < 2026.3.28 - SSRF Guard Bypass via IPv6 Special-Use Ranges | known not affected: 1 | 2026-06-05T19:36:36+00:00 | Vulnerability · Source |
| CVE-2026-41244 | redhat_vex | Mojic: Observable Timing Discrepancy in HMAC Verification | known not affected: 1 | 2026-06-05T19:36:36+00:00 | Vulnerability · Source |
| CVE-2026-41073 | redhat_vex | RT: Spreadsheet downloads vulnerable to CSV/formula injection in Microsoft Excel and similar apps | known not affected: 1 | 2026-06-05T19:36:36+00:00 | Vulnerability · Source |
| CVE-2026-41343 | redhat_vex | OpenClaw < 2026.3.31 - Denial of Service via LINE Webhook Handler Pre-Auth Concurrency | known not affected: 1 | 2026-06-05T19:36:35+00:00 | Vulnerability · Source |
| CVE-2026-41127 | redhat_vex | BigBlueButton's missing authorization allows viewer to inject/overwrite captions | known not affected: 1 | 2026-06-05T19:36:35+00:00 | Vulnerability · Source |
| CVE-2026-41954 | redhat_vex | iControl REST and tmsh vulnerability | known not affected: 1 | 2026-06-05T19:36:34+00:00 | Vulnerability · Source |
| CVE-2026-41909 | redhat_vex | OpenClaw < 2026.4.20 - Improper Authorization in Paired-Device Pairing Actions | known not affected: 1 | 2026-06-05T19:36:34+00:00 | Vulnerability · Source |
| CVE-2026-41585 | redhat_vex | ZEBRA: Denial of Service via Interrupted JSON-RPC Requests from Authenticated Clients | known not affected: 1 | 2026-06-05T19:36:34+00:00 | Vulnerability · Source |
| CVE-2026-41891 | redhat_vex | CI4MS: Deactivated User Session Bypass (active=0) | known not affected: 1 | 2026-06-05T19:36:33+00:00 | Vulnerability · Source |
| CVE-2026-41657 | redhat_vex | Admidio: Cross-Organization Member Data Exposure via Permission Check Mismatch in contacts_data.php | known not affected: 1 | 2026-06-05T19:36:33+00:00 | Vulnerability · Source |
| CVE-2026-41297 | redhat_vex | OpenClaw < 2026.3.31 - Server-Side Request Forgery via Marketplace Plugin Download Redirect | known not affected: 1 | 2026-06-05T19:36:33+00:00 | Vulnerability · Source |
| CVE-2026-41918 | redhat_vex | CVE-2026-41918 | known not affected: 1 | 2026-06-05T19:36:33+00:00 | Vulnerability · Source |
| CVE-2026-41483 | redhat_vex | Unbounded HTTP response body read in OpenTelemetry.Resources.Azure | known not affected: 1 | 2026-06-05T19:36:32+00:00 | Vulnerability · Source |
| CVE-2026-41960 | redhat_vex | CVE-2026-41960 | known not affected: 1 | 2026-06-05T19:36:32+00:00 | Vulnerability · Source |
| CVE-2026-41322 | redhat_vex | @astrojs/node: Cache Poisoning due to incorrect error handling when if-match header is malformed | known not affected: 1 | 2026-06-05T19:36:31+00:00 | Vulnerability · Source |
| CVE-2026-41519 | redhat_vex | Weblate's API Token Not Invalidated on Password Change | known not affected: 1 | 2026-06-05T19:36:30+00:00 | Vulnerability · Source |
| CVE-2026-41366 | redhat_vex | OpenClaw < 2026.3.31 - Arbitrary Host File Read via appendLocalMediaParentRoots Self-Whitelisting | known not affected: 1 | 2026-06-05T19:36:30+00:00 | Vulnerability · Source |
| CVE-2026-41340 | redhat_vex | OpenClaw < 2026.3.31 - Authentication Boundary Bypass via Telegram Legacy allowFrom Migration | known not affected: 1 | 2026-06-05T19:36:30+00:00 | Vulnerability · Source |
| CVE-2026-41078 | redhat_vex | OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path | known not affected: 1 | 2026-06-05T19:36:30+00:00 | Vulnerability · Source |
| CVE-2026-41915 | redhat_vex | OpenClaw < 2026.4.8 - Git Environment Variable Injection via Unfiltered Exec Environment | known not affected: 1 | 2026-06-05T19:36:29+00:00 | Vulnerability · Source |
| CVE-2026-41393 | redhat_vex | OpenClaw < 2026.3.31 - Arbitrary DNS Authority Acceptance and Credential Exfiltration via Wide-Area Discovery | known not affected: 1 | 2026-06-05T19:36:29+00:00 | Vulnerability · Source |
| CVE-2026-41591 | redhat_vex | Marko: XSS via case-insensitive script/style closing tag bypass in runtime HTML escaping | known not affected: 1 | 2026-06-05T19:36:28+00:00 | Vulnerability · Source |
| CVE-2026-41959 | redhat_vex | iControl and tmsh REST vulnerability | known not affected: 1 | 2026-06-05T19:36:27+00:00 | Vulnerability · Source |
| CVE-2026-41933 | redhat_vex | Vvveb < 1.0.8.3 Directory Listing Information Disclosure | known not affected: 1 | 2026-06-05T19:36:27+00:00 | Vulnerability · Source |
| CVE-2026-41177 | redhat_vex | Squidex has Blind SSRF via file:// Protocol in Restore API leading to Local File Interaction | known not affected: 1 | 2026-06-05T19:36:27+00:00 | Vulnerability · Source |
| CVE-2026-41339 | redhat_vex | OpenClaw < 2026.4.2 - Information Disclosure via Gateway Connect Snapshot | known not affected: 1 | 2026-06-05T19:36:27+00:00 | Vulnerability · Source |
| CVE-2026-41160 | redhat_vex | EspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes | known not affected: 1 | 2026-06-05T19:36:26+00:00 | Vulnerability · Source |